CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Telephone-Oriented Attack Delivery (TOAD) Bypasses Secure Email Gateways

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Telephone-Oriented Attack Delivery (TOAD) emails, which contain only a phone number as the payload, are bypassing secure email gateways and becoming a significant threat. These attacks, which accounted for nearly 28% of gateway-bypassing detections, exploit the simplicity of a phone number to evade detection and manipulate victims into revealing sensitive information or granting remote access. The attacks are particularly effective due to their ability to blend in with legitimate business communications and the increasing sophistication of evasion tactics.

Timeline

  1. 25.02.2026 16:00 1 articles · 3h ago

    TOAD Attacks Bypass Secure Email Gateways

    Between December 2025 and February 2026, researchers identified that TOAD attacks accounted for nearly 28% of all gateway-bypassing detections. These attacks use a simple phone number as the payload, making them difficult to detect and block. The study also found that attackers are using increasingly sophisticated evasion tactics, with over 1,400 unique combinations tracked.

    Show sources
    Open in new tab

Information Snippets

  • TOAD emails accounted for nearly 28% of all gateway-bypassing detections in a study of 5,000 email-based threat detections.

    First reported: 25.02.2026 16:00
    1 source, 1 article
    Show sources

  • TOAD attacks bypass email security architectures because the payload—a phone number—is indistinguishable from legitimate business contact.

    First reported: 25.02.2026 16:00
    1 source, 1 article
    Show sources

  • The average TOAD detection used more than four attack techniques simultaneously, with over 1,400 unique evasion combinations tracked.

    First reported: 25.02.2026 16:00
    1 source, 1 article
    Show sources

  • TOAD attacks are effective against both Google- and Microsoft-hosted email platforms.

    First reported: 25.02.2026 16:00
    1 source, 1 article
    Show sources

  • Sophisticated attacks use a multilayered approach, each layer defeating a different detection capability.

    First reported: 25.02.2026 16:00
    1 source, 1 article
    Show sources

  • A third of the attacks seen in the report were 'structurally invisible,' making them difficult to detect with conventional email rules.

    First reported: 25.02.2026 16:00
    1 source, 1 article
    Show sources